Cybersecurity researchers have uncovered a significant vulnerability in the Adobe Acrobat Chrome extension, which boasts over 314 million users. This flaw, identified as CVE-2026-48294 with a CVSS score of 7.4, could have allowed malicious websites to access users’ WhatsApp Web data without their knowledge.
Dubbed ‘HermeticReader’ by Guardio Labs, the vulnerability is classified as a universal cross-site scripting (UXSS) issue leading to cross-origin data disclosure. It affected all versions of the extension up to and including 26.5.2.2. Exploiting this flaw enabled attackers to bypass the browser’s same-origin policy, granting unauthorized access to session-bound data from different origins. The primary requirement for exploitation was user interaction—specifically, visiting a maliciously crafted URL or interacting with a compromised webpage that triggered the extension’s vulnerable code.
In practical terms, an attacker could craft a webpage designed to appear legitimate, such as one mimicking search results or marketing emails. When a user with the vulnerable Adobe Acrobat extension installed visited this page, the attacker could activate a dormant function within the extension. This function would then access WhatsApp Web, allowing the attacker to retrieve sensitive information like chat lists, contact names, messages, and profile details.
The exploitation process involved several steps:
- An attacker-controlled page embedded an iframe loaded from the extension’s resources.
- This iframe sent commands to modify settings, activating the ‘Hermes’ engine responsible for WhatsApp integration within the extension, contingent upon a specific feature flag being enabled.
- The malicious page then opened WhatsApp Web in a background browser tab.
- The iframe communicated directly with the ‘Hermes’ engine, targeting the WhatsApp tab after obtaining its numeric ID.
- The engine manipulated WhatsApp Web by injecting a POST form into its DOM, facilitating the extraction of WhatsApp data.
Notably, this attack did not require the installation of additional malware, phishing for user credentials, or extraction of session cookies. Merely visiting the malicious webpage was sufficient for the exploit to succeed.
Adobe has since addressed this vulnerability in the latest version of the Acrobat Chrome extension. Users are strongly advised to update their extensions promptly to mitigate potential risks. This incident underscores the importance of regular software updates and vigilance when interacting with unfamiliar web content.
In the broader context, this vulnerability highlights the evolving nature of cyber threats targeting widely-used browser extensions. As extensions become more integrated with various web services, they present attractive targets for attackers seeking to exploit cross-origin interactions. Users should remain cautious and ensure their software is up-to-date to protect against such sophisticated attacks.
